Choose your certification track.

CISA is the global gold standard for IS auditors. ERK's CISA track follows the current ISACA Review Manual domain weightings and integrates real audit engagements — including federal, financial-services, and enterprise SaaS cases — into every domain review.

1. Information System Auditing ProcessStandards, risk-based planning, evidence collection, reporting, and follow-up.
2. Governance & Management of ITEnterprise governance frameworks, IT strategy, organizational structure, and KPIs.
3. Information Systems Acquisition, Development & ImplementationProject governance, business case evaluation, system development lifecycle, and post-implementation review.
4. IS Operations & Business ResilienceCapacity management, incident response, business continuity, and disaster recovery.
5. Protection of Information AssetsIdentity & access management, cryptography, network security, and data classification.

CISM moves beyond technical control execution into the program-leadership space — strategy, stakeholder management, budget, and incident command. ERK's CISM track is taught from the perspective of someone who has actually owned these programs in federal and enterprise environments.

1. Information Security GovernanceStrategy development, regulatory alignment, organizational culture, and executive reporting.
2. Information Security Risk ManagementRisk identification, assessment methodologies, treatment options, and ongoing monitoring.
3. Information Security ProgramProgram development, resourcing, architecture, controls, awareness, and metrics.
4. Incident ManagementReadiness, classification, response, investigation, recovery, and lessons-learned.

CDPSE is the only ISACA certification focused on the engineer who actually builds and runs privacy controls. The track integrates GDPR, CCPA/CPRA, and emerging African data-protection regimes with concrete architectural patterns and hands-on labs.

1. Privacy GovernanceFrameworks, regulatory landscape, privacy policies, third-party management, and program metrics.
2. Privacy ArchitectureInfrastructure, data lifecycle, privacy-enhancing technologies, and secure data handling.
3. Data LifecycleData classification, retention, minimization, anonymization, and cross-border transfer.

CRISC is built for the practitioner who sits between audit findings and operational reality — the one who owns risk registers, KRIs, and the controls that actually run. ERK's CRISC track is case-based: every domain is anchored to a real risk-treatment decision.

1. GovernanceOrganizational strategy, governance frameworks, three-lines model, risk culture, and ethics.
2. IT Risk AssessmentRisk identification, analysis, evaluation, and the IT-risk register.
3. Risk Response & ReportingTreatment selection, control design, KRIs, monitoring, and executive reporting.
4. Information Technology & SecurityEnterprise architecture, IT operations, business resilience, and information security.